From c83ce1e2407f5388608ba5325601efb79ce9cb9f Mon Sep 17 00:00:00 2001 From: Karl Berry Date: Wed, 17 Feb 2016 19:20:30 +0000 Subject: set openout_any to a (instead of p) for all the luatex engines git-svn-id: svn://tug.org/texlive/trunk@39755 c570f23f-e606-0410-a88d-b1316a301751 --- Build/source/texk/kpathsea/ChangeLog | 5 +++++ Build/source/texk/kpathsea/texmf.cnf | 16 +++++++++++++++- 2 files changed, 20 insertions(+), 1 deletion(-) (limited to 'Build/source') diff --git a/Build/source/texk/kpathsea/ChangeLog b/Build/source/texk/kpathsea/ChangeLog index 82b10a2ba0e..02bcecf7876 100644 --- a/Build/source/texk/kpathsea/ChangeLog +++ b/Build/source/texk/kpathsea/ChangeLog @@ -1,3 +1,8 @@ +2016-02-17 Karl Berry + + * texmf.cnf (openout_any.*lua*): set to a, since otherwise nothing + nontrivial can be run, as of TL'16. As I understand it. + 2016-02-03 Akira Kakuto * win32lib.[ch], mingw32.[ch]: Define a function diff --git a/Build/source/texk/kpathsea/texmf.cnf b/Build/source/texk/kpathsea/texmf.cnf index 33cc0b7c229..547219ba077 100644 --- a/Build/source/texk/kpathsea/texmf.cnf +++ b/Build/source/texk/kpathsea/texmf.cnf @@ -601,7 +601,21 @@ TEXMF_RESTRICTED_SCRIPTS = \ openin_any = a openout_any = p -% Write .log/.dvi/etc. files here, if the current directory is unwritable. +% As of TeX Live 2016, the LuaTeX engines reimplemented the `p' setting +% such that even the simplest documents could not be run. Besides, most +% safeguards can be bypassed through Lua with sufficient effort. +% Therefore we specific the reality here. For those concerned with +% security and luatex, the --safer option is the place to start, and +% running entirely in a sandboxed environment (ConTeXt has support for +% this) is probably the place to end. +openout_any.dvilualatex = a +openout_any.dviluatex = a +openout_any.luajittex = a +openout_any.lualatex = a +openout_any.lualollipop = a +openout_any.luatex = a + +% Write .log/.dvi/.aux/etc. files here, if the current directory is unwritable. %TEXMFOUTPUT = /tmp % If a dynamic file creation fails, log the command to this file, in -- cgit v1.2.3